<html>
<head><meta charset="utf-8"><title>Proposed alternative to transmute MCP · project-safe-transmute · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/index.html">project-safe-transmute</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Proposed.20alternative.20to.20transmute.20MCP.html">Proposed alternative to transmute MCP</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="235480257"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Proposed%20alternative%20to%20transmute%20MCP/near/235480257" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Olivier FAURE <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Proposed.20alternative.20to.20transmute.20MCP.html#235480257">(Apr 21 2021 at 09:31)</a>:</h4>
<p>I've written an alternative to the safe-transmute MCP: <a href="https://gist.github.com/PoignardAzur/7c4eda06bf129df0a42cc9f55def4d3c">https://gist.github.com/PoignardAzur/7c4eda06bf129df0a42cc9f55def4d3c</a></p>
<p>It's not super polished because I'm not sure there's much interest for it, so I just wanted to get this out. The syntax I propose aims to avoid relying on "magic" intrinsics, and tries to address some of the points discussed between <span class="user-mention" data-user-id="117495">@rpjohnst</span> and <span class="user-mention" data-user-id="219211">@Jack Wrenn</span> in december.</p>



<a name="235548151"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Proposed%20alternative%20to%20transmute%20MCP/near/235548151" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jack Wrenn <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Proposed.20alternative.20to.20transmute.20MCP.html#235548151">(Apr 21 2021 at 17:17)</a>:</h4>
<blockquote>
<p>Overall, use-cases proposed by the proposal author seem to require unsafe even in places where the semantics should be provably safe.</p>
</blockquote>
<p>Can you point out the examples you have in mind? The <a href="https://jswrenn.github.io/transmutation-foundation/unresolved-trait-methods.html">MCP punts on actually providing a safe transmute function/method bc of bikeshedding issues</a> — and so the examples in the MCP stick to the existing mechanisms for transmutation, and just use the trait to <em>check</em> transmutability — but it's trivial to define such a safe function. But, if there are other occurrences of <code>unsafe</code> you have in mind, I'd like to be sure I've accounted for them.</p>



<a name="235549093"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Proposed%20alternative%20to%20transmute%20MCP/near/235549093" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> oliver <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Proposed.20alternative.20to.20transmute.20MCP.html#235549093">(Apr 21 2021 at 17:23)</a>:</h4>
<p>this seems similar to earlier proposals, how is it different from <code>Muckable</code>?</p>



<a name="235549999"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Proposed%20alternative%20to%20transmute%20MCP/near/235549999" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> oliver <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Proposed.20alternative.20to.20transmute.20MCP.html#235549999">(Apr 21 2021 at 17:29)</a>:</h4>
<p><a href="https://hackmd.io/@jswrenn/S192QCR9D#Type-Parameter">https://hackmd.io/@jswrenn/S192QCR9D#Type-Parameter</a></p>



<a name="235551453"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Proposed%20alternative%20to%20transmute%20MCP/near/235551453" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jack Wrenn <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Proposed.20alternative.20to.20transmute.20MCP.html#235551453">(Apr 21 2021 at 17:38)</a>:</h4>
<p><span class="user-mention silent" data-user-id="281739">oliver</span> <a href="#narrow/stream/216762-project-safe-transmute/topic/Proposed.20alternative.20to.20transmute.20MCP/near/235549093">said</a>:</p>
<blockquote>
<p>this seems similar to earlier proposals, how is it different from <code>Muckable</code>?</p>
</blockquote>
<p>It does seem similar to the <code>Muckable</code> family of proposals:</p>
<ul>
<li>If <code>CanTransmuteFromFields</code> is required on both the source and destination types, it's directly analogous to <code>Muckable</code>. If it's only required on the destination type, it's analogous to <code>MuckableFrom</code>.  </li>
<li>Unlike the <code>Muckable</code> proposals, <code>CanTransmuteFromFields</code> features a type parameter which is used to implement the <a href="https://jack.wrenn.fyi/blog/private-trait-impls/">scoped impls pattern</a>, but is otherwise un-magical.</li>
</ul>



<a name="235551764"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Proposed%20alternative%20to%20transmute%20MCP/near/235551764" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jack Wrenn <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Proposed.20alternative.20to.20transmute.20MCP.html#235551764">(Apr 21 2021 at 17:40)</a>:</h4>
<p><span class="user-mention silent" data-user-id="281739">oliver</span> <a href="#narrow/stream/216762-project-safe-transmute/topic/Proposed.20alternative.20to.20transmute.20MCP/near/235549999">said</a>:</p>
<blockquote>
<p><a href="https://hackmd.io/@jswrenn/S192QCR9D#Type-Parameter">https://hackmd.io/@jswrenn/S192QCR9D#Type-Parameter</a></p>
</blockquote>
<p>What's the detail in that document you're trying to draw attention to? The design of the <code>Neglect</code> parameter is basically identical between the MCP and <span class="user-mention" data-user-id="263609">@Olivier FAURE</span>'s proposal.</p>



<a name="235553996"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Proposed%20alternative%20to%20transmute%20MCP/near/235553996" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Olivier FAURE <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Proposed.20alternative.20to.20transmute.20MCP.html#235553996">(Apr 21 2021 at 17:55)</a>:</h4>
<p>Yeah, the main difference is using a token to emulate private/scoped trait impls. I don't  think this particular trick has been suggested before.</p>



<a name="235555231"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Proposed%20alternative%20to%20transmute%20MCP/near/235555231" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jack Wrenn <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Proposed.20alternative.20to.20transmute.20MCP.html#235555231">(Apr 21 2021 at 18:04)</a>:</h4>
<p>It hasn't been suggested! The design space around the <code>Muckable</code> family of proposals is pretty subtle, and I suspect this will be a useful trick to consider when those design discussions start back up.  (Though I suspect there will also be some steep opposition, since the scoped impl pattern isn't well-known!)</p>



<a name="235556415"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Proposed%20alternative%20to%20transmute%20MCP/near/235556415" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jack Wrenn <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Proposed.20alternative.20to.20transmute.20MCP.html#235556415">(Apr 21 2021 at 18:10)</a>:</h4>
<p>If the analogy between <code>CanTransmuteFromFields</code> and <code>Muckable</code> is apt, then it'll also be that case that this alternative proposal can be implemented atop the MCP, too; e.g.:</p>
<div class="codehilite" data-code-language="Rust"><pre><span></span><code><span class="k">pub</span><span class="w"> </span><span class="k">mod</span> <span class="nn">alternative</span><span class="w"> </span><span class="p">{</span><span class="w"></span>

<span class="w">    </span><span class="cp">#[marker]</span><span class="w"></span>
<span class="w">    </span><span class="k">pub</span><span class="w"> </span><span class="k">unsafe</span><span class="w"> </span><span class="k">trait</span><span class="w"> </span><span class="n">CanTransmuteFrom</span><span class="o">&lt;</span><span class="n">Src</span><span class="p">,</span><span class="w"> </span><span class="n">Token</span><span class="p">,</span><span class="w"> </span><span class="k">const</span><span class="w"> </span><span class="n">ASSUME</span>: <span class="nc">Assume</span><span class="o">&gt;</span><span class="w"></span>
<span class="w">    </span><span class="k">where</span><span class="w"></span>
<span class="w">        </span><span class="n">Src</span>: <span class="o">?</span><span class="nb">Sized</span><span class="w"></span>
<span class="w">    </span><span class="p">{}</span><span class="w"></span>

<span class="w">    </span><span class="k">pub</span><span class="w"> </span><span class="k">unsafe</span><span class="w"> </span><span class="k">trait</span><span class="w"> </span><span class="n">CanTransmuteFromFields</span><span class="o">&lt;</span><span class="n">Token</span><span class="o">&gt;</span><span class="w"></span>
<span class="w">    </span><span class="p">{}</span><span class="w"></span>

<span class="w">    </span><span class="k">impl</span><span class="o">&lt;</span><span class="n">Src</span><span class="p">,</span><span class="w"> </span><span class="n">Dst</span><span class="p">,</span><span class="w"> </span><span class="n">Token</span><span class="o">&gt;</span><span class="w"> </span><span class="n">CanTransmuteFrom</span><span class="o">&lt;</span><span class="n">Src</span><span class="p">,</span><span class="w"> </span><span class="n">Token</span><span class="p">,</span><span class="w"> </span><span class="k">const</span><span class="w"> </span><span class="n">ASSUME</span>: <span class="nc">Assume</span><span class="o">&gt;</span><span class="w"></span>
<span class="w">    </span><span class="k">where</span><span class="w"></span>
<span class="w">        </span><span class="n">Src</span>: <span class="o">?</span><span class="nb">Sized</span><span class="w"> </span><span class="o">+</span><span class="w"> </span><span class="n">CanTransmuteFromFields</span><span class="o">&lt;</span><span class="n">Token</span><span class="o">&gt;</span><span class="p">,</span><span class="w"> </span><span class="c1">// this bound is problematic</span>
<span class="w">        </span><span class="n">Dst</span>: <span class="o">?</span><span class="nb">Sized</span><span class="w"> </span><span class="o">+</span><span class="w"> </span><span class="n">CanTransmuteFromFields</span><span class="o">&lt;</span><span class="n">Token</span><span class="o">&gt;</span><span class="p">,</span><span class="w"></span>
<span class="w">        </span><span class="n">Dst</span>: <span class="nc">BikeshedIntrinsicFrom</span><span class="o">&lt;</span><span class="n">Src</span><span class="p">,</span><span class="w"> </span><span class="p">(),</span><span class="w"> </span><span class="n">ASSUME</span><span class="w"> </span><span class="o">+</span><span class="w"> </span><span class="n">Assume</span>::<span class="n">VISIBILITY</span><span class="o">&gt;</span><span class="w"></span>
<span class="w">    </span><span class="p">{}</span><span class="w"></span>

<span class="p">}</span><span class="w"></span>
</code></pre></div>



<a name="235559109"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Proposed%20alternative%20to%20transmute%20MCP/near/235559109" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jack Wrenn <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Proposed.20alternative.20to.20transmute.20MCP.html#235559109">(Apr 21 2021 at 18:30)</a>:</h4>
<p>A similar idea to this one was bounced around for <code>Muckable</code>:</p>
<blockquote>
<p>Types that are trivially transmutable to their fields (eg <code>(Foo, Bar, i32)</code>) will implement <code>CanTransmuteFromFields&lt;(), ...&gt;</code>, meaning that any context can provide a token enabling that transmutation.</p>
<p>By default, types with private fields and <code>#[non_exhaustive]</code> types don't implement CanTransmuteFromFields.</p>
</blockquote>
<p>I'd like to see this explored further, but it's tricky to get it  right. A public field can be functionally private:</p>
<div class="codehilite" data-code-language="Rust"><pre><span></span><code><span class="k">pub</span><span class="w"> </span><span class="k">struct</span> <span class="nc">Foo</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">  </span><span class="k">pub</span><span class="w"> </span><span class="n">bar</span>: <span class="nc">private</span>::<span class="n">Bar</span><span class="p">,</span><span class="w"></span>
<span class="p">}</span><span class="w"></span>

<span class="k">mod</span> <span class="nn">private</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">  </span><span class="k">pub</span><span class="w"> </span><span class="k">struct</span> <span class="nc">Bar</span><span class="p">;</span><span class="w"></span>
<span class="p">}</span><span class="w"></span>
</code></pre></div>
<p>...so you can't tell whether a type is fully implicitly constructible or not <em>just</em> by looking at its definition. Generics add another layer of complexity to this.</p>



<a name="235561677"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Proposed%20alternative%20to%20transmute%20MCP/near/235561677" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jack Wrenn <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Proposed.20alternative.20to.20transmute.20MCP.html#235561677">(Apr 21 2021 at 18:48)</a>:</h4>
<hr>
<p>Back to the MCP: There are a <em>lot</em> of different abstractions over transmutability I'd like to see built — it's a huge design space.</p>
<p>The main appeal of the MCP is that it's expressive enough to be a foundation for <em>all</em> of those abstractions.</p>



<a name="235561869"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Proposed%20alternative%20to%20transmute%20MCP/near/235561869" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jack Wrenn <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Proposed.20alternative.20to.20transmute.20MCP.html#235561869">(Apr 21 2021 at 18:50)</a>:</h4>
<p>If we discover a valuable abstraction that fundamentally cannot be built atop the MCP, resolving that shortcoming that would be an urgent priority. Otherwise, I don't think there's a whole lot that would radically alter the MCP.</p>



<a name="235563585"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Proposed%20alternative%20to%20transmute%20MCP/near/235563585" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jack Wrenn <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Proposed.20alternative.20to.20transmute.20MCP.html#235563585">(Apr 21 2021 at 19:01)</a>:</h4>
<p>I <em>think</em> the MCP is flexible enough to handle anything we through at it. Starting from first principles, if you asked me to assess whether a given transmutation was safe, I'd need to check the layout of the <code>Src</code> type, the layout of the <code>Dst</code> type, and context the transmutation occurs in.</p>
<p>Since each of these pieces of information is encoded in the signature <code>BikeshedIntrinsicFrom</code>, the compiler could, in principle, do as advanced an analysis as any human can do.</p>
<p>The analysis performed by the <em>initial</em> implementation might simple, but AFAIK we aren't shutting any doors with the signature of <code>BikeshedIntrinsicFrom</code>. (E.g.:  the initial implementation might not do the visibility checks, but that will be enough to build a <code>Muckable</code>-style abstraction atop it.)</p>



<a name="235563919"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/216762-project-safe-transmute/topic/Proposed%20alternative%20to%20transmute%20MCP/near/235563919" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> oliver <a href="https://rust-lang.github.io/zulip_archive/stream/216762-project-safe-transmute/topic/Proposed.20alternative.20to.20transmute.20MCP.html#235563919">(Apr 21 2021 at 19:03)</a>:</h4>
<p><span class="user-mention silent" data-user-id="219211">Jack Wrenn</span> <a href="#narrow/stream/216762-project-safe-transmute/topic/Proposed.20alternative.20to.20transmute.20MCP/near/235551764">said</a>:</p>
<blockquote>
<p><span class="user-mention silent" data-user-id="281739">oliver</span> <a href="#narrow/stream/216762-project-safe-transmute/topic/Proposed.20alternative.20to.20transmute.20MCP/near/235549999">said</a>:</p>
<blockquote>
<p><a href="https://hackmd.io/@jswrenn/S192QCR9D#Type-Parameter">https://hackmd.io/@jswrenn/S192QCR9D#Type-Parameter</a></p>
</blockquote>
<p>What's the detail in that document you're trying to draw attention to? The design of the <code>Neglect</code> parameter is basically identical between the MCP and <span class="user-mention silent" data-user-id="263609">Olivier FAURE</span>'s proposal.</p>
</blockquote>
<p>attached mostly as prior art</p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>